CISA adds Apple Authentication flaw to KEV catalog after active exploitation

CISA added CVE-2024-27834 to the catalog on November 4, 2026. The agency confirmed that attackers are exploiting the Apple authentication flaw in the wild.

The US National Vulnerability Database gives CVE-2024-27834 a medium severity rating and a CVSS score of 5.5. CISA describes this kind of weakness as a common method used by harmful cyber actors and says it creates major risks for the federal government. The medium rating does not lower the priority because exploitation is confirmed in the wild.

The flaw lets an attacker with the ability to read and write arbitrary memory bypass Pointer Authentication on affected Apple systems. Pointer Authentication runs on Apple processors as a hardware-based mechanism. It attaches cryptographic signatures to pointers, which guard memory addresses against malicious modification.

Attackers are actively exploiting the flaw in the wild, and that activity prompted CISA to add it to the KEV catalog even though the flaw carries only a medium severity rating. CISA calls this vulnerability a frequent attack vector for malicious cyber actors and says it poses significant risks to the federal enterprise.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise."

CISA, Security Affairs

The fix arrived in May 2024. Apple shipped improved checks for iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5.

Agencies in the Federal Civilian Executive Branch face a November 18, 2026 deadline to apply the patches under Binding Operational Directive 22-01. The KEV designation triggers this mandatory patching obligation, and agencies must complete the updates by that date or remain out of compliance with the directive.

Sekoia rates its confidence as moderate to high that APT29 is behind the activity. The group goes by Cozy Bear and Midnight Blizzard as well. Sekoia describes APT29 as state-sponsored. The group has ties to Russia’s Foreign Intelligence Service.

Attackers reached victims through three initial access methods: compromised legitimate websites, fake copies of popular websites, and a supply chain compromise involving Plerdy SEO Tracker. The zero-click chain sends malicious JavaScript to exploit the flaw, profiles the visitor’s device, and drops information-stealing malware that gathers browser cookies and device data.

Sekoia describes a zero-click chain that combines CVE-2025-43529, a WebKit remote code execution flaw, with CVE-2024-27834. The second flaw bypasses Pointer Authentication Codes and enables arbitrary code execution. The two flaws work together to give attackers full control without any action from the victim. No click or other visitor action is needed to start the chain.

Pwn2Own Vancouver used the vulnerability in a zero-day demonstration in March 2024. Apple shipped the fix in May 2024, after the public demonstration. The flaw was already public before the patches reached users.

EPSS estimates the probability of exploitation in the next 30 days at 0.6 percent. That figure exceeds the level for 49 percent of all scored vulnerabilities. The estimate comes from the Exploit Prediction Scoring System.

Apple issued security advisories for the fix. The advisories appear at support.apple.com/en-us/120896, 120898, 120901, 120902, 120903, and 120905. The advisories cover each operating system affected by the flaw.

Users on devices that cannot receive the update should avoid the affected app for sensitive tasks and plan a replacement. The fix stays inactive until users restart the app or device after installing the update. Automatic updates also deliver future fixes without any manual checks.